Static task
static1
Behavioral task
behavioral1
Sample
2e9b982f8b280baca145ca3b40c08fdd_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2e9b982f8b280baca145ca3b40c08fdd_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2e9b982f8b280baca145ca3b40c08fdd_JaffaCakes118
-
Size
419KB
-
MD5
2e9b982f8b280baca145ca3b40c08fdd
-
SHA1
b9f841f4ab1082a62a0bf0c5fb3e747921de96a1
-
SHA256
b3d2969eee960827c78e2dfd7b7a170cb51582fdc3851ffaf477c223dfa440e3
-
SHA512
774783d1afad0620374b5552bb5ad73e0eaa7802af0c23a7e5856c33436db5a02c75c01aba6fe48d04505ccfa78c794746728a617eda15a81ac5b9f20d5eac62
-
SSDEEP
12288:/XYrYSRrrfLd9Uppx40IsNwK2xb7bPlO85:/XeYGrTd9UlzutbPlO85
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e9b982f8b280baca145ca3b40c08fdd_JaffaCakes118
Files
-
2e9b982f8b280baca145ca3b40c08fdd_JaffaCakes118.exe windows:4 windows x86 arch:x86
121c7dd7849ef4cf38826827a445d58b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
ReleaseDC
CreateWindowExA
GetTopWindow
InsertMenuW
ExcludeUpdateRgn
SendMessageTimeoutW
advapi32
CryptSignHashW
RegCreateKeyExA
RegDeleteKeyA
RegConnectRegistryW
CryptGetDefaultProviderW
RegRestoreKeyW
CryptDestroyHash
RegDeleteKeyW
RegCreateKeyExW
CryptSetProviderExW
RegOpenKeyW
CryptGetDefaultProviderA
LookupAccountNameW
LookupAccountSidW
RegSetKeySecurity
CryptSetProviderA
AbortSystemShutdownW
RegSetValueW
wininet
InternetOpenUrlA
FindNextUrlCacheEntryA
InternetWriteFileExA
InternetAutodialHangup
CommitUrlCacheEntryW
InternetCrackUrlA
FtpFindFirstFileA
InternetCanonicalizeUrlA
InternetSetDialStateA
kernel32
CompareStringW
HeapAlloc
GetStdHandle
InitializeCriticalSection
GetTimeZoneInformation
IsValidLocale
QueryPerformanceCounter
HeapReAlloc
GetModuleHandleA
GetFileType
DeleteCriticalSection
HeapSize
GetLocaleInfoA
GetLastError
UnhandledExceptionFilter
GetCPInfo
EnumDateFormatsExA
GetCommandLineA
InterlockedExchange
LeaveCriticalSection
CreatePipe
GetLocaleInfoW
IsValidCodePage
HeapDestroy
IsBadWritePtr
HeapFree
SetHandleCount
FreeLibrary
WaitForMultipleObjectsEx
SetLastError
TerminateProcess
EnumSystemLocalesA
GetCommandLineW
CompareStringA
TlsFree
GetCurrentProcessId
GetTickCount
LoadLibraryA
GetEnvironmentStringsW
GetOEMCP
VirtualQuery
CommConfigDialogA
GetStartupInfoW
RtlUnwind
GetSystemInfo
GetModuleFileNameA
MultiByteToWideChar
GetACP
WriteFile
VirtualProtect
GetUserDefaultLCID
GetStartupInfoA
LCMapStringW
GetCurrentThreadId
GetStringTypeW
TlsSetValue
GetTimeFormatA
GetDateFormatW
EnterCriticalSection
GetDateFormatA
TlsGetValue
ExitProcess
TlsAlloc
FreeEnvironmentStringsA
SetEnvironmentVariableA
GlobalFindAtomA
GetVersionExA
GetSystemTimeAsFileTime
HeapCreate
VirtualAlloc
LCMapStringA
VirtualFree
FreeEnvironmentStringsW
GetStringTypeA
GetCurrentThread
GetProcAddress
GetEnvironmentStrings
WideCharToMultiByte
GetCurrentProcess
GetModuleFileNameW
comdlg32
ChooseColorW
shell32
DoEnvironmentSubstA
SHBrowseForFolder
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 278KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ